Presentation is loading. Please wait.

Presentation is loading. Please wait.

Outline Designing and Writing Secure Code –General principles –Example: sendmail vs qmail Compiler Prime: Run-time Environment and Program Organization.

Similar presentations


Presentation on theme: "Outline Designing and Writing Secure Code –General principles –Example: sendmail vs qmail Compiler Prime: Run-time Environment and Program Organization."— Presentation transcript:

1 Outline Designing and Writing Secure Code –General principles –Example: sendmail vs qmail Compiler Prime: Run-time Environment and Program Organization Buffer Overflow

2 General Principles Compartmentalization –Principle of least privilege –Minimize trust relationships Defense in depth –Use more than one security mechanism –Secure the weakest link –Fail securely Promote privacy Keep it simple Consult experts –Don’t build what you can easily borrow/steal –Open review is effective and informative

3 Compartmentalization Divide system into modules –Each module serves a specific purpose –Assign different access rights to different modules Read/write access to files Read user or network input Execute privileged instructions (e.g., Unix root) Principle of least privilege –Give each module only the rights it needs Minimize trust relationships –Clients, servers should not trust each other Both can get hacked –Trusted code should not call untrusted code

4 Defense in Depth Failure is unavoidable – plan for it Have a series of defenses –If an error or attack is not caught by one mechanism, it should be caught by another Examples –Firewall + network intrusion detection Fail securely –Many, many vulnerabilities are related to error handling, debugging or testing features, error messages –Ensure that you handle errors –Do not expose system internals even in case of errors Stack traces, internal errors,... shown to clients –Test if your system fails securely

5 Defense in Depth Check security Application.dll Application.exe Check security Secure resource with an ACL Application.dll [MSDN]

6 Secure the weakest link Think about possible attacks –How would someone try to attack this? –What would they want to accomplish? Find weakest link(s) –Crypto library is probably pretty good –Is there a way to work around crypto? Data stored in encrypted form; where is key stored? Main point –Do security analysis of the whole system –Spend your time where it matters

7 Promote Privacy Discard information when no longer needed –No one can attack system to get information Examples –Don’t keep log of old session keys –Delete firewall logs –Don’t run unnecessary services (fingerd) Hiding sensitive information is hard –Information in compiled binaries can be found –Insider attacks are common

8 Keep It Simple Use standard, tested components –Don’t implement your own cryptography Don’t add unnecessary features –Extra functionality  more ways to attack Use simple algorithms that are easy to verify –A trick that may save a few instructions may Make it harder to get the code right Make it harder to modify and maintain code

9 Don’t reinvent the wheel Consult experts Allow public review Use software, designs that others have used Examples –Bad use of crypto: b –Protocols without expert review: early i –Use standard url parser, crypto library, good random number generator, …

10 Security by Obscurity … Information in compiled binaries can be found –Reverse engineering –Disassembler: machine code to assembly –Discomplier: machine code to high-level language Insider attacks are common –Firewalls do not protect against inside attacks Assume an attacker knows everything you know Why? –If attacker has 1-in-a-million chance, and there are a million attackers, you are out of luck Is NOT Secure !!!

11 Example: Mail Transport Agents Sendmail –Complicated system –Source of many vulnerabilities Qmail –Simpler system designed with security in mind –Gaining popularity Qmail was written by Dan Bernstein, starting 1995 $500 reward for successful attack; no one has collected

12 Simplified Mail Transactions mbox Mail User Agent Mail Delivery Agent Mail Transport Agent Mail User Agent Message composed using an MUA MUA gives message to MTA for delivery –If local, the MTA gives it to the local MDA –If remote, transfer to another MTA

13 Example: Qmail Compartmentalize –Nine separate modules –If one module compromised, others not Move separate functions into mutually untrusting programs Always validate input from other modules

14 THE BIG Qmail PICTURE tcpserver / tcp-env / inetd qmail-smtpdqmail-inject qmail-queue qmail-send qmail-rspawn qmail-remote qmail-lspawn qmail-local mbox / maildir / program delivery MUA remote mailserver SMTP from networkfrom local to local qmail-system forwarded message

15 Structure of qmail qmail-smtpd qmail-localqmail-remote qmail-lspawnqmail-rspawn qmail-send qmail-inject qmail-queue Incoming SMTP mail Other incoming mail

16 Structure of qmail qmail-smtpd qmail-localqmail-remote qmail-lspawnqmail-rspawn qmail-send qmail-inject qmail-queue Reads the message and creates an entry in the mail queue Signals qmail-send

17 Structure of qmail qmail-smtpd qmail-localqmail-remote qmail-lspawnqmail-rspawn qmail-send qmail-inject qmail-queue qmail-send signals –qmail-lspawn if local –qmail-remote if remote

18 Structure of qmail qmail-smtpd qmail-local qmail-lspawn qmail-send qmail-inject qmail-queue qmail-lspawn –Spawns qmail-local –qmail-local runs with ID of user receiving local mail

19 Structure of qmail qmail-smtpd qmail-local qmail-lspawn qmail-send qmail-inject qmail-queue qmail-local –Handles alias expansion –Delivers local mail –Calls qmail-queue if needed

20 Structure of qmail qmail-smtpd qmail-remote qmail-rspawn qmail-send qmail-inject qmail-queue qmail-remote –Delivers message to remote MTA

21 Least Privilege in Qmail Each module uses least privileges necessary Each runs under different non-privileged UID in four groups: qmaild, qmailr, qmails, and qmailq –Except one as root Only one run as root: qmail-lspawn (except qmail- start) –Spawns the local delivery program under the UID and GID of the user being delivered to –Always changes effective uid to recipient before running user-specified program

22 Principles, sendmail vs qmail Do as little as possible in setuid programs –Of 20 recent sendmail security holes, 11 worked only because the entire sendmail system is setuid –Only qmail-queue is setuid Its only function is add a new message to the queue Do as little as possible as root –The entire sendmail system runs as root Operating system protection has no effect –Only qmail-start and qmail-lspawn run as root.

23 Least privilege qmail-smtpd qmail-localqmail-remote qmail-lspawnqmail-rspawn qmail-send qmail-inject qmail-queue root setuid

24 Keep it simple Parsing –Limited parsing of strings Minimizes risk of security holes from configuration errors –Modules do parsing are isolated and run with user privilege Libraries –Avoid standard C library, stdio Small code is more secure –Plug in interposing modules rather than complicating the core code

25 Backup Slides

26 Designing and Writing Secure Code

27 Secure Programming Techniques: An Abstract View of Program Avoid buffer overflow Secure software design Language-specific problems Application-specific issues Program Component Validate input Respond judiciously Call other code carefully

28 Secure Programming Validate all your inputs –Command line inputs, environment variables, CGI inputs, … –Don't just reject “bad” input, define “good” and reject all else Avoid buffer overflow Carefully call out to other resources –Check all system calls and return values

29 Comparison LinesWordsCharsFiles qmail sendmail zmailer-2.2e smail exim

30 Comparison with other MTAs MTAMaturitySecurityFeaturesPerform ance Modular QmailMediumHigh Yes SendmailHighLowHighLowNo PostfixMediumHighMediumHighYes


Download ppt "Outline Designing and Writing Secure Code –General principles –Example: sendmail vs qmail Compiler Prime: Run-time Environment and Program Organization."

Similar presentations


Ads by Google